diff --git a/AGENTS.md b/AGENTS.md
index ae83d0b..753fea2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -49,6 +49,10 @@ Management (IAM) fabric and WebAuthn Passkey authority.
    - Offer potential code changes clearly, but NEVER execute edits
      (`write_to_file`, `replace_file_content`) or git commits until the user
      explicitly reviews the proposal and confirms execution.
+4. **Standard Task Protocols (`tasks/path.md`):**
+   - Follow the standardized engineering lifecycle: `tasks/plan.md`
+     $\rightarrow$ `tasks/audit-1.md` $\rightarrow$ `tasks/do.md` $\rightarrow$
+     `tasks/audit-2.md`, with `tasks/debug.md` for hermetic root-cause analysis.
 
 ## 4. History & Context Link
 
diff --git a/README.md b/README.md
index 7f30f0a..b8d0bbf 100644
--- a/README.md
+++ b/README.md
@@ -63,6 +63,44 @@ workload identity.
 
 ---
 
+## 🛠️ Engineering Lifecycle & Task Protocols
+
+Auth-Yes development follows a strict, disciplined 4-step task lifecycle
+designed to preserve context, prevent regressions, and enforce dual-level
+deliberation between human developers and AI agents.
+
+```mermaid
+flowchart LR
+    subgraph Lifecycle ["Sequential Engineering Lifecycle"]
+        direction LR
+        P["1. plan<br/>(tasks/plan.md)"] --> A1["2. audit-1<br/>(tasks/audit-1.md)"]
+        A1 --> D["3. do<br/>(tasks/do.md)"]
+        D --> A2["4. audit-2<br/>(tasks/audit-2.md)"]
+    end
+
+    subgraph Standalone ["On-Demand / Any Time"]
+        DBG["debug<br/>(tasks/debug.md)"]
+    end
+
+    DBG -.->|"Feeds Root Cause into"| P
+```
+
+### Protocol Quick Reference
+
+| Step / Tool | Protocol File                              | Role           | Purpose                                                                    | Direct Command          | Prompt Prep Command              |
+| :---------: | :----------------------------------------- | :------------- | :------------------------------------------------------------------------- | :---------------------- | :------------------------------- |
+|    **1**    | [**`tasks/plan.md`**](tasks/plan.md)       | System Analyst | Deep codebase research & drafting task in `tasks/new/`                     | `tasks/plan XYZ`        | `tasks/plan a prompt for Jules`  |
+|    **2**    | [**`tasks/audit-1.md`**](tasks/audit-1.md) | Plan Critic    | 5-point plan audit, scoring, and refinement                                | `tasks/audit-1 task #1` | `tasks/audit-1 prompt for Jules` |
+|    **3**    | [**`tasks/do.md`**](tasks/do.md)           | Developer      | Execution, state machine (`wip/` $\rightarrow$ `complete/`), quality gates | `tasks/do task #1`      | `tasks/do a prompt for Jules`    |
+|    **4**    | [**`tasks/audit-2.md`**](tasks/audit-2.md) | QA Auditor     | Post-implementation code quality & zero-regression audit                   | `tasks/audit-2 branch`  | `tasks/audit-2 prompt for Jules` |
+|     🔬      | [**`tasks/debug.md`**](tasks/debug.md)     | Investigator   | Hermetic root-cause analysis & experiments in `scratch/`                   | `tasks/debug issue`     | `tasks/debug a prompt for Jules` |
+
+_For master guidelines and orchestrator index, see
+[**`tasks/path.md`**](tasks/path.md) and
+[**`tasks/GUIDELINES.md`**](tasks/GUIDELINES.md)._
+
+---
+
 ## 2. Core Security Architecture & Defense-in-Depth Layering
 
 Auth-Yes implements a strict multi-layered defense model ensuring that neither